UBUNTU-CVE-2026-74520: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopfqueueremovedevice(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopfgroupresponse() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using one of the listed Ubuntu kernel packages are potentially exposed when IOMMUFD handles I/O page faults (IOPFs) for a device. The affected path involves IOPF group delivery to userspace and device detach or HWPT replacement.
What conditions are needed to trigger the use-after-free?
An accepted IOPF group must be queued for IOMMUFD userspace handling while also remaining on the generic pending list. A device detach or HWPT replacement must then reduce the device IOPF reference count to zero, allowing the IOMMU driver to remove and free the group before a later read, response, or cleanup accesses it.
What is the impact if the flaw is triggered?
A later IOMMUFD read, response, or cleanup can access a freed IOPF group, resulting in a use-after-free. The supplied severity vector rates the issue as high, with high confidentiality, integrity, and availability impact and scope changed.
How was the issue fixed?
The fix removes an accepted IOPF group from the generic pending list before IOMMUFD queues it for userspace response. It also ensures iopf_group_response() sends a response even when the group is no longer a member of the pending list.